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DETAILED ACTION 

Continued Examination Under 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 4/22/09 
has been entered. 

Status of Claims 

2. Due to communications filed 4/22/09, the following is a non-final office action. 
Claims 1,10 and 18 are amended. Claims 1-26 are pending in this application and 
have been examined on the merits. The previous rejection has been withdrawn, and 
claims 1-26 are now rejected as follows. 
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Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth 
in section 1 02 of this title, if the differences between the subject matter sought to be patented and the 
prior art are such that the subject matter as a whole would have been obvious at the time the invention 
was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability 
shall not be negatived by the manner in which the invention was made. 

4. Claims 1-25 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Breslin et al (US 2004/0098285 A1 ), and further in view of Jaskolski et al (US 
2003/0055684 A1 ), and further in view of Sarno (US 2002/0042751 A). 

As per Claim 1 , Breslin et al discloses a customer relationship management 
(CRM) system that is accessible via a network, ([0009], core repository that manages, 
monitors and measures all data privacy assessments across an institution, [0030], using 
a distributed client/server architecture , w/[0031], client is a web-based browser 
application), comprising: 

a user interface that provides distributed access for support providers to 
information within the CRM system, (page 7, table 6 [OAP 1] shows the user interface 
has a list of applications to select from), 

and wherein the user interface provides access to a customer management page 
for viewing all cases opened for a given customer and a case summary page for 
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viewing details of individual stored within the CRM system, ([0077)], shows a user 
interface screen for providing the user with access to the collection, library, of data 
privacy materials that has been collected by the enterprise, and tables 4 and 6 shows 
user is able to select an application from a list of applications, [0013], user interface that 
allows upper management to review risk exposure and compliance status, and Fig 5, 
Fig 11); 

- a management system for managing customer, wherein the management 
system includes a system for assigning to different tiers within a support provider 
hierarchy; ([0015], access levels for review of risk exposure and compliance) and 

-a compliance tracking system that retrieves previously loaded customer 
compliance data from a database, ([0055], shows database can be consulted when 
system determines the compliance of the application with the laws and regulations of 
the jurisdictions in which the application operates); 

wherein the compliance data consists of information related to whether a 
customer has met certain required pre-set goals set by the CRM system, compares the 
compliance data for each customer with predetermined levels to determine customer 
compliance and provides a compliance indicator on the customer management page, 
([0012], shows compliance with applicable sate and Federal laws is assessed and once 
risk is acknowledged, a plan for reducing the risk or bringing the groups procedures into 
compliance can be formulated, and progress towards compliance can be tracked, and 
[0069], compliance indicator is displayed, in this case comparing is obvious since 
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compliance with applicable state and Federal laws requires some type of comparison 
between current applications and the state and Federal laws). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to compare compliance data for each customer with predetermined 
levels with the motivation of determining current compliance data. 

Breslin et al fails to disclose allowing the customer to access case information, 
and, wherein the customers and the support providers are separate and distinct 
institutions, however does disclose that an application could have contact with both 
customer and employee data in [0047], and in [0033], lines 1-6 of Breslin et al, they 
show that the person assigned with the responsibility to assess a particular application 
that involves data with a privacy component describes the application to system 10, and 
the responsibility for describing the application is typically assigned to the manager in 
charge of the application, thereby suggesting a case since the manager is assigned to 
an application. However, Jaskolski et al discloses a participant in the system may be 
the patient himself, or skilled and unskilled staff in a case management situation, as 
shown in [0039], and where case number assignment is incorporated in [0048]. It 
therefore would be obvious to combine the teachings of Breslin et al and Jaskolski et al 
to disclose allowing the customer to access case information, and, wherein the 
customers and the support providers are separate and distinct institutions. 

It would have been obvious to one of ordinary skill in the art at the time of the 
application to disclose allowing the customer to access case information, and, wherein 
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the customers and the support providers are separate and distinct institutions with the 
motivation of showing that two individual parties are able to access case information. 

Neither Breslin nor Jaskolski et al disclose wherein a customer case includes a 
request from the customer to the support provider for support, however, in [0033], lines 
1-6 of Breslin et al, they show that the person assigned with the responsibility to assess 
a particular application that involves data with a privacy component describes the 
application to system 10, and the responsibility for describing the application is typically 
assigned to the manager in charge of the application, thereby suggesting a case since 
the manager is assigned to an application, and also, Page 7, table 7 [Web 4] of Breslin 
shows that the customer has an opt out selection for data privacy review, which 
suggests a "request" since if the customer does not opt out for data privacy services, 
this is analogous to a request for services. 

However, Sarno shows the detailed review of different screens of an individual 
case in Figs 2-12, Sarno discloses that intermediate service providers provides 
infomediary services (e.g., for a transaction fee), and for example, the intermediate 
service may be provided as an Internet application that allows buyers to submit 
requests for solutions based upon a business case. It therefore would be obvious to 
combine the teachings of Breslin et al and Sarno to disclose wherein a customer case 
includes a request from the customer to the support provider for support. 

It would have been obvious to one of ordinary skill in the art at the time of the 
application to disclose wherein a customer case includes a request from the customer 
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to the support provider for support with the motivation of showing that a case involves a 
request to provide services. 

As per Claim 2, Breslin et al further discloses the CRM system of claim 1 , 
wherein the case management system further includes a notification system for 
automatically generating emails when a new case is opened, ([0040], email notifying the 
person of the assignment and the responsibilities associated therewith) 

As per Claim 3, Breslin et al further discloses the CRM system of claim 1 , 
wherein the case management system further includes a system that allows support 
providers to check-in/check-out cases, ([0040], when assignment is made, input screen 
shows date on which the assignment was accepted and updates the applicable 
database to record the assignment , [0045], shows alternate assignments, which makes 
checking out cases obvious since when re-assigning to an alternate application, the 
case must be checked out for the first application). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to check-out cases with the motivation of ending processing of a 
first case. 

As per Claim 4, Breslin et al further discloses the CRM system of claim 1 , 
wherein the case management system further includes a set of business rules that 
determines what level of case information is to be made available to customers and 
support providers. ([0014], higher level managers have broader access than lower level 
managers, which is based on seniority) 
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As per Claim 5, Breslin et al further discloses the CRM system of claim 1 , 
wherein the case management system further includes a set of business rules that 
determines how cases are to be assigned and escalated among the different tiers of 
support providers. ([0014], cases are assigned based on seniority) 

As per Claim 6, Breslin et al further discloses the CRM system of claim 1 , 
wherein the compliance tracking system includes a set of business rules that 
determines a compliance risk level for each customer. ([0014], ability to access risk 
assessment data) 

As per claims 7-8, 12, 17 and 24-25 , Breslin et al discloses mostly all of the 
limitations including wherein the portal page provides access to a customer case 
management page for viewing all cases opened for a given customer and a case 
summary page for viewing details of individual cases as shown in [0004], where a 
summary or compiled data is shown. 

Breslin et al also discloses wherein the compliance risk level is selected from the 
group consisting of: in compliance, in danger of becoming out of compliance, and out of 
compliance in [0012], where compliance is shown with applicable sate and Federal laws 
is assessed and once risk is acknowledged, a plan for reducing the risk or bringing the 
groups procedures into compliance can be formulated, and progress towards 
compliance can be tracked. 

Breslin et al also discloses and also wherein the compliance indicator comprises 
a traffic light indicator having a green, yellow, and red light as shown in [0073], where 
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green, amber and red are shown as compliance indicators. In this case, amber 
represents yellow. 

As per Claim 9, Breslin et al further discloses the CRM system of claim 6, 
wherein the compliance tracking system includes a system for creating a new customer 
case when a predetermined compliance risk level occurs (abstract, lines 18-24, If a risk 
exists, a plan for reducing the risk or bringing the application into compliance can be 
formulated, and progress towards compliance can be tracked, w/[0010], shows a six- 
step system to bring status into compliance, which includes employing automated 
questionnaires, which is a step involved in processing of assessment for each 
application, which therefore suggests that the process is done for new applications 
since as shown in [0033], the person is just assigned to a particular application for the 
purpose of review/assessment). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to create a new customer case when a predetermined compliance 
risk level occurs with the motivation of creating a new case that can be re-assessed for 
compliance. 

As per Claim 10, Breslin et al further discloses a method for providing customer 
relationship management (CRM) via a computer network, comprising: 

-providing a network node that allows distributed access, ([0009], core repository that 
manages, monitors and measures all data privacy assessments across an institution, 
[0030], using a distributed client/server architecture , w/[0031], client is a web-based 
browser application); 
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-opening a new case within the CRM system when a customer issue occurs, 
(abstract, lines 1 8-24, If a risk exists, a plan for reducing the risk or bringing the 
application into compliance can be formulated, and progress towards compliance can 
be tracked, w/[0010], shows a six-step system to bring status into compliance, which 
includes employing automated questionnaires, which is a step involved in processing of 
assessment for each application, which therefore suggests that the process is done for 
new applications since as shown in [0033], the person is just assigned to a particular 
application for the purpose of review/assessment). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to create a new customer case when a predetermined compliance 
risk level occurs with the motivation of creating a new case that can be re-assessed for 
compliance. 

- adding the new case to a customer case management page; ([0054], add 
button adds jurisdictions that are applicable to the application under review) 

- displaying a compliance indicator when the customer case management page 
is viewed; ([0069], compliance indicator is displayed); 

wherein the compliance indicator is based on information related to whether a 
customer has met certain required pre-set goals set by the CRM system, ([0012], shows 
compliance with applicable sate and Federal laws is assessed and once risk is 
acknowledged, a plan for reducing the risk or bringing the groups procedures into 
compliance can be formulated, and progress towards compliance can be tracked); 
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- assigning the new case to a first tier support provider; ([0033], lines 1-8, 
assignment to the manager in charge of the application, as this is the person in the 
organization with the most intimate knowledge about the current state of the operation 
of the application at any given time) 

The following is suggested by Breslin et al since access levels are assigned 
based on seniority or management status as shown in [0015], and higher management 
is shown to have more knowledge as shown in [0033]: 
-determining if the first tier support provider can handle the new case; and 
-escalating the new case to a second tier support provider if the first tier support 
provider cannot handle the case. 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to determine if the first tier support provider can handle the new 
case, and escalate the new case to a second tier support provider if the first tier support 
provider cannot handle the case with the motivation of providing a case for assessment 
to someone with more knowledge. 

Breslin et al fails to disclose for access for both customers and support providers 
to a CRM System, wherein the customers and the support providers are separate and 
distinct institutions, however does disclose that an application could have contact with 
both customer and employee data in [0047]. 

However, Jaskolski et al discloses A participant in the system may be the patient 
himself, or skilled and unskilled staff as shown in [0039]. It therefore would be obvious 
to combine the teachings of Breslin et al and Jaskolski et al to disclose allowing the 
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customer to access case information, and , wherein the customers and the support 
providers are separate and distinct institutions. 

It would have been obvious to one of ordinary skill in the art at the time of the 
application to disclose allowing the customer to access case information, and , wherein 
the customers and the support providers are separate and distinct institutions with the 
motivation of showing that two individual parties are able to access case information. 

Neither Breslin nor Jaskolski et al disclose wherein the customer issue includes a 
request from the customer to the support provider for support, however, in Page 7, table 
7 [Web 4] of Breslin shows that the customer has an opt out selection for data privacy 
review, which suggests a "request" since if the customer does not opt out for data 
privacy services, this is analogous to a request for services. 

However, Sarno shows the detailed review of different screens of an individual 
case in Figs 2-12, Sarno discloses that intermediate service providers provides 
infomediary services (e.g., for a transaction fee), and for example, the intermediate 
service may be provided as an Internet application that allows buyers to submit 
requests for solutions based upon a business case. It therefore would be obvious to 
combine the teachings of Breslin et al and Sarno to disclose wherein the customer issue 
includes a request from the customer to the support provider for support 

It would have been obvious to one of ordinary skill in the art for the customer 
issue to include a request from the customer to the support provider for support with the 
motivation of showing that for an issue, customers recommend services from providers. 



Application/Control Number: 10/630,392 
Art Unit: 3628 



Page 13 



As per Claim 11. Breslin et al further discloses the method of claim 10, wherein the 
network node comprises a web portal. ([0035], application portal) 

As per Claim 13. Breslin et al further discloses the method of claim 10, comprising the 
further step of generating email notifications according to a set of business rules, 
([0040], email notifying the person of the assignment and the responsibilities associated 
therewith) 

As per Claim 14. Breslin et al discloses having an assigned support provider 
check out the case from the CRM system. ([0043], outside support providers). 

As per Claim 15. Breslin et al discloses, wherein the step of opening a new case 
is performed by the customer at the network node, ([0009], core repository that 
manages, monitors and measures all data privacy assessments across an institution, 
[0030], using a distributed client/server architecture , w/[0031], client is a web-based 
browser application); 

As per Claim 16. Breslin et al further discloses, wherein the step of opening a 
new case is initiated automatically when the customer is out of compliance. ([0046], 
assessment is accomplished automatically). 
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As per Claim 18, Breslin et al further discloses a program product stored on a 
recordable medium that provides a customer relationship management (CRM) tool via 
the web, comprising: 

-a portal page for providing distributed access on the web, and wherein the portal page 
provides access to a customer case management page for viewing all cases opened for 
a given customer and a case summary page for viewing details of individual cases, 
([0035], shows incorporation of an application portal, w/[0077)], shows a user interface 
screen for providing the user with access to the collection, library, of data privacy 
materials that has been collected by the enterprise, and tables 4 and 6 shows user is 
able to select an application from a list of applications, [0013], user interface that allows 
upper management to review risk exposure and compliance status, [0004], where a 
summary or compiled data is shown, and Fig 5, Fig 1 1 ); 

-a customer management module for managing customer cases and for 
assigning cases to different tiers within a support provider hierarchy, ([0033], lines 1-8, 
assignment to the manager in charge of the application, as this is the person in the 
organization with the most intimate knowledge about the current state of the operation 
of the application at any given time and ([0015], access levels for review of risk 
exposure and compliance) and 
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-a customer compliance module retrieves previously loaded customer compliance data 
from a database, ([0055], shows database can be consulted when system determines 
the compliance of the application with the laws and regulations of the jurisdictions in 
which the application operates); 

wherein the compliance data consists of information related to whether a 
customer has met certain required pre-set goals set by the CRM system, compares the 
compliance data for each customer with predetermined levels to track customer 
compliance and displays a compliance indicator on customer case management page, 
([0012], shows compliance with applicable sate and Federal laws is assessed and once 
risk is acknowledged, a plan for reducing the risk or bringing the groups procedures into 
compliance can be formulated, and progress towards compliance can be tracked, and 
[0069], compliance indicator is displayed, in this case comparing is obvious since 
compliance with applicable state and Federal laws requires some type of comparison 
between current applications and the state and Federal laws). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to compare compliance data for each customer with predetermined 
levels with the motivation of determining current compliance data. 

Breslin et al fails to disclose access for customers and support 
providers to case information within the CRM tool, wherein the customers and the 
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support providers are separate and distinct institutions however does disclose that an 
application could have contact with both customer and employee data in [0047]. 

However, Jaskolski et al discloses a participant in the system may be the patient 
himself, or skilled and unskilled staff as shown in [0039]. It therefore would be obvious 
to combine the teachings of Breslin et al and Jaskolski et al to disclose access for 
customers and support providers to case information within the CRM tool, wherein the 
customers and the support providers are separate and distinct institutions. 

It would have been obvious to one of ordinary skill in the art at the time of the 
application to disclose access for customers and support providers to case information 
within the CRM tool, wherein the customers and the support providers are separate and 
distinct institutions with the motivation of showing that two individual parties are able to 
access case information. 

Neither Breslin nor Jaskolski et al disclose wherein a customer case includes a 
request from the customer to the support provider for support, however, in Page 7, table 
7 [Web 4] of Breslin shows that the customer has an opt out selection for data privacy 
review, which suggests a "request" since if the customer does not opt out for data 
privacy services, this is analogous to a request for services. 

However, Sarno shows the detailed review of different screens of an individual 
case in Figs 2-12, Sarno discloses that intermediate service providers provides 
infomediary services (e.g., for a transaction fee), and for example, the intermediate 
service may be provided as an Internet application that allows buyers to submit 
requests for solutions based upon a business case. It therefore would be obvious to 
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combine the teachings of Breslin et al and Sarno to disclose wherein a customer case 
includes a request from the customer to the support provider for support. 

It would have been obvious to one of ordinary skill in the art for the customer 
case to include a request from the customer to the support provider for support with the 
motivation of showing that for a case, customers recommend services from providers. 

As per Claim 19, Breslin et al further discloses the program product of claim 18, 
wherein the case management module further includes a notification system for 
automatically generating emails when a new case is opened, ([0040], email notifying the 
person of the assignment and the responsibilities associated therewith) 

As per Claim 20, Breslin et al further discloses the program product of claim 18, 
wherein the case management module further includes a system that allows support 
providers to check-in/check-out cases, ([0040], when assignment is made, input screen 
shows date on which the assignment was accepted and updates the applicable 
database to record the assignment , [0045], shows alternate assignments, which makes 
checking out cases obvious since when re-assigning to an alternate application, the 
case must be checked out for the first application). 



As per Claim 21 , Breslin et al further discloses the program product of claim 18, wherein 
the case management module further includes a set of business rules that determines 
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what level of case information is to be made available to customers and support 
providers. ([0014], higher level managers have broader access than lower level 
managers, which is based on seniority) 

As per Claim 22, Breslin et al further discloses the program product of claim 18, wherein 
the case management module further includes a set of business rules that determines 
how cases are to be assigned and escalated among the different tiers of support 
providers. ([0014], cases are assigned based on seniority) 

As per Claim 23, Breslin et al further discloses the program product of claim 18, wherein 
the compliance tracking module includes a set of business rules that determines a 
compliance risk level for each customer. ([0014], ability to access risk assessment data) 

As per Claim 26, The program product of claim 23, wherein the compliance tracking 
module includes a system for creating a new customer case when a predetermined 
compliance risk level occurs, (abstract, lines 18-24, If a risk exists, a plan for reducing 
the risk or bringing the application into compliance can be formulated, and progress 
towards compliance can be tracked, w/[0010], shows a six-step system to bring status 
into compliance, which includes employing automated questionnaires, which is a step 
involved in processing of assessment for each application, which therefore suggests 
that the process is done for new applications since as shown in [0033], the person is 
just assigned to a particular application for the purpose of review/assessment). 
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It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to create a new customer case when a predetermined compliance 
risk level occurs with the motivation of creating a new case that can be re-assessed for 
compliance. 

Response to Arguments 

5. Applicant's arguments with respect to claims 1-26 have been considered but are 
moot in view of the new ground(s) of rejection. 



Conclusion 

6. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Akiba K Robinson-Boyce whose telephone number is 
571-272-6734. The examiner can normally be reached on Monday-Friday 9am-5:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Hayes can be reached on 571-272-6708. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
Information regarding the status of an application may be obtained from the 
•Patent Application Information Retrieval (PAIR) system, Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
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more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO 
Customer Service Representative or access to the automated information system, call 
800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is 703-305- 
3900. 

A. R. B. 
June 9, 2009 



/Akiba K Robinson-Boyce/ 
Primary Examiner, Art Unit 3628 



